FROM GSM TO LTE-ADVANCED

Transcription

1

2

3 FROM GSM TO LTE-ADVANCED

4

5 FROM GSM TO LTE-ADVANCED AN INTRODUCTION TO MOBILE NETWORKS AND MOBILE BROADBAND Revised 2 nd Edition Martin Sauter WirelessMoves, Germany

6 This edition first published John Wiley & Sons, Ltd Registered office John Wiley & Sons Ltd, The Atrium, Southern Gate, Chichester, West Sussex, PO19 8SQ, United Kingdom For details of our global editorial offices, for customer services and for information about how to apply for permission to reuse the copyright material in this book please see our website at The right of the author to be identified as the author of this work has been asserted in accordance with the Copyright, Designs and Patents Act All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted, in any form or by any means, electronic, mechanical, photocopying, recording or otherwise, except as permitted by the UK Copyright, Designs and Patents Act 1988, without the prior permission of the publisher. Wiley also publishes its books in a variety of electronic formats. Some content that appears in print may not be available in electronic books. Designations used by companies to distinguish their products are often claimed as trademarks. All brand names and product names used in this book are trade names, service marks, trademarks or registered trademarks of their respective owners. The publisher is not associated with any product or vendor mentioned in this book. This publication is designed to provide accurate and authoritative information in regard to the subject matter covered. It is sold on the understanding that the publisher is not engaged in rendering professional services. If professional advice or other expert assistance is required, the services of a competent professional should be sought. Library of Congress Cataloging-in-Publication Data Sauter, Martin. [From GSM to LTE] From GSM to LTE-advanced : an introduction to mobile networks and mobile broadband / Martin Sauter. Revised 2nd edition. pages cm Includes bibliographical references and index. ISBN (cloth) 1. Mobile communication systems. 2. Wireless metropolitan area networks. 3. Wireless LANs. I. Title. TK S dc A catalogue record for this book is available from the British Library. Print ISBN: Set in 10/12pt, TimeLTStd by Laserwords Private Limited, Chennai, India

7 Contents Preface xiii 1 Global System for Mobile Communications (GSM) Circuit-Switched Data Transmission Classic Circuit Switching Virtual Circuit Switching over IP Standards Transmission Speeds The Signaling System Number The Classic SS-7 Protocol Stack SS-7 Protocols for GSM IP-Based SS-7 Protocol Stack The GSM Subsystems The Network Subsystem The Mobile Switching Center (MSC), Server and Gateway The Visitor Location Register (VLR) The Home Location Register (HLR) The Authentication Center The Short Messaging Service Center (SMSC) The Base Station Subsystem (BSS) and Voice Processing Frequency Bands The Base Transceiver Station (BTS) The GSM Air Interface The Base Station Controller (BSC) The TRAU for Voice Encoding Channel Coder and Interleaver in the BTS Ciphering in the BTS and Security Aspects Modulation Voice Activity Detection Mobility Management and Call Control Cell Reselection and Location Area Update The Mobile-Terminated Call Handover Scenarios 56

8 vi Contents 1.9 The Mobile Device Architecture of a Voice-Centric Mobile Device Architecture of a Smartphone The SIM Card The Intelligent Network Subsystem and CAMEL 67 Questions 70 References 70 2 General Packet Radio Service (GPRS) and EDGE Circuit-Switched Data Transmission over GSM Packet-Switched Data Transmission over GPRS The GPRS Air Interface GPRS vs. GSM Timeslot Usage on the Air Interface Mixed GSM/GPRS Timeslot Usage in a Base Station Coding Schemes Enhanced Datarates for GSM Evolution (EDGE) Mobile Device Classes Network Mode of Operation GPRS Logical Channels on the Air Interface The GPRS State Model GPRS Network Elements The Packet Control Unit (PCU) The Serving GPRS Support Node (SGSN) The Gateway GPRS Support Node (GGSN) GPRS Radio Resource Management GPRS Interfaces GPRS Mobility Management and Session Management (GMM/SM) Mobility Management Tasks GPRS Session Management Session Management from a User s Point of View Small Screen Web Browsing over GPRS and EDGE WAP 1.1 Used in Early GPRS Devices WAP Small Screen Web Browsing with Network Side Compression Small Screen Web Browsing Quality of Experience The Multimedia Messaging Service (MMS) over GPRS Web Browsing via GPRS Impact of Delay on the Web-Browsing Experience Web Browser Optimization for Mobile Web Browsing 127 Questions 128 References Universal Mobile Telecommunications System (UMTS) and High-Speed Packet Access (HSPA) Overview, History and Future GPP Release 99: The First UMTS Access Network Implementation 131

9 Contents vii GPP Release 4: Enhancements for the Circuit-Switched Core Network GPP Release 5: IMS and High-Speed Downlink Packet Access GPP Release 6: High-Speed Uplink Packet Access (HSUPA) GPP Release 7: Even Faster HSPA and Continued Packet Connectivity GPP Release 8: LTE, Further HSPA Enhancements and Femtocells GPP Release 9: Digital Dividend and Dual Cell Improvements GPP Releases 10 and 11: LTE-Advanced Important New Concepts of UMTS The Radio Access Bearer (RAB) The Access Stratum and Nonaccess Stratum Common Transport Protocols for CS and PS Code Division Multiple Access (CDMA) Spreading Factor, Chip Rate and Process Gain The OVSF Code Tree Scrambling in Uplink and Downlink Direction UMTS Frequency and Cell Planning The Near Far Effect and Cell Breathing Advantages of the UMTS Radio Network Compared to GSM UMTS Channel Structure on the Air Interface User Plane and Control Plane Common and Dedicated Channels Logical, Transport and Physical Channels Example: Network Search Example: Initial Network Access Procedure The Uu Protocol Stack The UMTS Terrestrial Radio Access Network (UTRAN) Node-B, Iub Interface, NBAP and FP The RNC, Iu, Iub and Iur Interfaces, RANAP and RNSAP Adaptive Multirate (AMR) NB and WB Codecs for Voice Calls Radio Resource Control (RRC) States Core Network Mobility Management Radio Network Mobility Management Mobility Management in the Cell-DCH State Mobility Management in Idle State Mobility Management in Other States UMTS CS and PS Call Establishment UMTS Security High-Speed Downlink Packet Access (HSDPA) and HSPA HSDPA Channels Shorter Delay Times and Hybrid ARQ (HARQ) Node-B Scheduling Adaptive Modulation and Coding, Transmission Rates and Multicarrier Operation 204

10 viii Contents Establishment and Release of an HSDPA Connection HSDPA Mobility Management High-Speed Uplink Packet Access (HSUPA) E-DCH Channel Structure The E-DCH Protocol Stack and Functionality E-DCH Scheduling E-DCH Mobility E-DCH-Capable Devices Radio and Core Network Enhancements: CPC and One Tunnel A New Uplink Control Channel Slot Format CQI Reporting Reduction and DTX and DRX HS-SCCH Discontinuous Reception HS-SCCH-less Operation Enhanced Cell-FACH and Cell-/URA-PCH States Radio Network Enhancement: One Tunnel HSPA Performance in Practice Throughput in Practice Radio Resource State Management Power Consumption Web-Browsing Experience UMTS and CDMA Questions 232 References Long Term Evolution (LTE) and LTE-Advanced Introduction and Overview Network Architecture and Interfaces LTE Mobile Devices and the LTE Uu Interface The enode-b and the S1 and X2 Interfaces The Mobility Management Entity (MME) The Serving Gateway (S-GW) The PDN-Gateway The Home Subscriber Server (HSS) Billing, Prepaid and Quality of Service FDD Air Interface and Radio Network OFDMA for Downlink Transmission SC-FDMA for Uplink Transmission Symbols, Slots, Radio Blocks and Frames Reference and Synchronization Signals The LTE Channel Model in Downlink Direction Downlink Management Channels System Information Messages The LTE Channel Model in Uplink Direction MIMO Transmission HARQ and Other Retransmission Mechanisms 263

11 Contents ix PDCP Compression and Ciphering Protocol Layer Overview TD-LTE Air Interface Scheduling Downlink Scheduling Uplink Scheduling Basic Procedures Cell Search Attach and Default Bearer Activation Handover Scenarios Default and Dedicated Bearers Mobility Management and Power Optimization Mobility Management in Connected State Mobility Management in Idle State Mobility Management And State Changes In Practice LTE Security Architecture Interconnection with UMTS and GSM Cell Reselection between LTE and GSM/UMTS RRC Connection Release with Redirect between LTE and GSM/UMTS Handover between LTE and GSM/UMTS Interworking with CDMA2000 Networks Cell Reselection between LTE and CDMA2000 Networks RRC Connection Release with Redirect between LTE and CDMA Handover between LTE and CDMA Network Planning Aspects Single Frequency Network Cell Edge Performance Self-Organizing Network Functionality CS-Fallback for Voice and SMS Services with LTE SMS over SGs CS Fallback Voice in Combined LTE and CDMA 2000 Networks (SV-LTE) Voice over LTE (VoLTE) The Session Initiation Protocol (SIP) The IP Multimedia Subsystem (IMS) and VoLTE Single Radio Voice Call Continuity Internet-Based Alternatives LTE Bearer Configurations for VoIP Backhaul Considerations LTE-Advanced (3GPP Release 10 12) Carrier Aggregation Downlink and 4 4 Uplink MIMO Relays 321

12 x Contents HetNets, ICIC and eicic Coordinated Multipoint Operation Future LTE Uses: Machine Type Communication and Public Safety 324 Questions 324 References Wireless Local Area Network (WLAN) Wireless LAN Overview Transmission Speeds and Standards WLAN Configurations: From Ad Hoc to Wireless Bridging Ad Hoc, BSS, ESS and Wireless Bridging SSID and Frequency Selection Management Operations The MAC Layer Air Interface Access Control The MAC Header The Physical Layer and MAC Extensions IEEE b 11 Mbit/s IEEE g with up to 54 Mbit/s IEEE a with up to 54 Mbit/s IEEE n with up to 600 Mbits/s ac Gigabit Wireless Wireless LAN Security Wired Equivalent Privacy (WEP) WPA and WPA2 Personal Mode Authentication WPA and WPA2 Enterprise Mode Authentication EAP-SIM Authentication WPA and WPA2 Encryption Wi-Fi-Protected Setup (WPS) IEEE e and WMM Quality of Service Comparison of Wireless LAN and LTE 376 Questions 379 References Bluetooth Overview and Applications Physical Properties Piconets and the Master/Slave Concept The Bluetooth Protocol Stack The Baseband Layer The Link Controller The Link Manager The HCI Interface The L2CAP Layer The Service Discovery Protocol 400

13 Contents xi The RFCOMM Layer Overview of Bluetooth Connection Establishment Bluetooth Security Pairing up to Bluetooth Pairing with Bluetooth 2.1 (Secure Simple Pairing) Authentication Encryption Authorization Security Modes Bluetooth Profiles Basic Profiles: GAP, SDP and the Serial Profile Object Exchange Profiles: FTP, Object Push and Synchronize Headset, Hands-Free and SIM Access Profile High-Quality Audio Streaming The Human Interface Device (HID) Profile 422 Questions 424 References 424 Index 427

14

15 Preface Wireless technologies like GSM, UMTS, LTE, Wireless LAN and Bluetooth have revolutionized the way we communicate and exchange data by making services like telephony and Internet access available anytime and from almost anywhere. Today, a great variety of technical publications offer background information about these technologies but they all fall short in one way or another. Books covering these technologies usually describe only one of the systems in detail and are generally too complex as a first introduction. The Internet is also a good source, but the articles one finds are usually too short and superficial or only deal with a specific mechanism of one of the systems. For this reason, it was difficult for me to recommend a single publication to students in my telecommunication classes, which I have been teaching in addition to my work in the wireless telecommunication industry. This book aims to change this. Each of the six chapters in this book gives a detailed introduction and overview of one of the wireless systems mentioned above. Special emphasis has also been put into explaining the thoughts and reasoning behind the development of each system. Not only the how but also the why is of central importance in each chapter. Furthermore, comparisons are made to show the differences and commonalities between the technologies. For some applications, several technologies compete directly with each other, while in other cases only a combination of different wireless technologies creates a practical application for the end user. For readers who want to test their understanding of a system, each chapter concludes with a list of questions. For further investigation, all chapters contain references to the relevant standards and other documents. These provide an ideal additional source to find out more about a specific system or topic. Please note that there is a companion website for this book. Please go to While working on the book, I have gained tremendous benefit from wireless technologies that are already available today. Whether at home or while traveling, Wireless LAN, Bluetooth, UMTS and LTE have provided reliable connectivity for my research and have allowed me to communicate with friends and loved ones at anytime, from anywhere. In a way, the book is a child of the technologies it describes. Many people have been involved in revising the different chapters and have given invaluable suggestions on content, style and grammar. I would therefore like to thank Prashant John, Timothy Longman, Tim Smith, Peter van den Broek, Prem Jayaraj, Kevin Wriston, Greg Beyer, Ed Illidge, Debby Maxwell and John Edwards for their kind help and good advice. Furthermore, my sincere thanks go to Berenike, who has stood by me during this project with her love, friendship and good advice.

16 xiv Preface Readers familiar with previous editions of this book will find many updates in this revision. In Chapter 1, additional information has been included on the 3GPP Release 4 Mobile Switching Center architecture that is now used in most networks. In Chapter 2, only few updates were necessary because the deployed feature sets of GPRS and EDGE networks have remained stable in recent years. Chapter 3 was significantly enhanced as High-Speed Packet Access (HSPA) features such as higher order modulation, dual carrier operation and enhanced mobility management states are now in widespread use. While only a few LTE networks were in operation at the publication of the previous edition, the technology has since spread and significantly matured. Chapter 4 was therefore extended to describe Circuit-Switched Fallback (CSFB) for voice telephony in more detail. In addition, a section on Voice over LTE (VoLTE) was added to give a solid introduction to standardized voice over IP telephony in LTE networks. Furthermore, a description of LTE-Advanced features was added at the end of the chapter. As the global success of LTE has significantly reduced the importance of WiMAX, the chapter on this technology was removed from this revised edition. In Chapter 5, on Wi-Fi, a new section was added on the new ac air interface. Also, a new section was added to describe the Wi-Fi-Protected Setup (WPS) mechanism that is part of commercial products today. Finally, the chapter on Bluetooth has also seen some changes as some applications such as dial-up networking have been replaced by other technologies such as Wi-Fi tethering. Bluetooth has become popular for other uses, however, such as for connecting keyboards to smartphones and tablets. This chapter has therefore been extended to cover these developments. Martin Sauter Cologne January 2014

17 1 Global System for Mobile Communications (GSM) At the beginning of the 1990s, GSM, the Global System for Mobile Communications triggered an unprecedented change in the way people communicate with each other. While earlier analog wireless systems were used by only a few people, GSM is used by over 5 billion subscribers worldwide in This has mostly been achieved by the steady improvements in all areas of telecommunication technology and the resulting steady price reductions for both infrastructure equipment and mobile devices. This chapter discusses the architecture of this system, which also forms the basis for the packet-switched extension called General Packet Radio Service (GPRS), discussed in Chapter 2, for the Universal Mobile Telecommunications System (UMTS), which is described in Chapter 3 and Long-Term Evolution (LTE), which is discussed in Chapter 4. While the first designs of GSM date back to the middle of the 1980s, GSM is still the most widely used wireless technology worldwide and it is not expected to change any time soon. Despite its age and the evolution toward UMTS and LTE, GSM itself continues to be developed. As shown in this chapter, GSM has been enhanced with many new features in recent years. Therefore, many operators continue to invest in their GSM networks in addition to their UMTS and LTE activities to introduce new functionality and to lower their operational cost. In addition, it should be mentioned at this point that the industry has standardized on a new solution for voice telephony for LTE that has only little in common with GSM anymore. Although standardization is complete, efforts to roll out the new system are significant, and at the time of writing, there were only few voice-over LTE systems to be found in practice. Current LTE-capable devices thus continue using GSM and UMTS networks for voice telephony with a fallback mechanism. 1.1 Circuit-Switched Data Transmission Initially, GSM was designed as a circuit-switched system that establishes a direct and exclusive connection between two users on every interface between all network nodes of the system. Section gives a first overview of this traditional architecture. Over time, this physical From GSM to LTE-Advanced: An Introduction to Mobile Networks and Mobile Broadband, Revised Second Edition. Martin Sauter John Wiley & Sons, Ltd. Published 2014 by John Wiley & Sons, Ltd.

18 2 From GSM to LTE-Advanced circuit switching has been virtualized and many network nodes are connected over IP-based broadband connections today. The reasons for this and further details on virtual circuit switching can be found in Section Classic Circuit Switching The GSM mobile telecommunication network has been designed as a circuit-switched network in a similar way to fixed-line phone networks. At the beginning of a call, the network establishes a direct connection between two parties, which is then used exclusively for this conversation. As shown in Figure 1.1, the switching center uses a switching matrix to connect any originating party to any destination party. Once the connection has been established, the conversation is then transparently transmitted via the switching matrix between the two parties. The switching center only becomes active again to clear the connection in the switching matrix if one of the parties wants to end the call. This approach is identical in both mobile and fixed-line networks. Early fixed-line telecommunication networks were designed only for voice communication, for which an analog connection between the parties was established. In the mid-1980s, analog technology was superseded by digital technology in the switching center. This meant that calls were no longer sent over an analog line from the originator to the terminator. Instead, the switching center digitized the analog signal that it received from the subscribers, which were directly attached to it, and forwarded the digitized signal to the terminating switching center. There, the digital signal was again converted back to an analog Figure 1.1 Switching matrix in a switching center

19 Global System for Mobile Communications (GSM) 3 Fixed line subscriber and call control Switching and signaling software Operating system of the switching center Mobile subscriber management Mobility management Call control Switching and signaling software Operating system of the switching center Figure 1.2 Necessary software changes to adapt a fixed-line switching center for a wireless network signal, which was then sent over the copper cable to the terminating party. In some countries, ISDN (Integrated Services Digital Network) lines were quite popular. With this system, the transmission became fully digital and the conversion back into an analog audio signal was done directly in the phone. GSM reuses much of the fixed-line technology that was already available at the time the standards were created. Thus, existing technologies such as switching centers and long-distance communication equipment were used. The main development for GSM, as shown in Figure 1.2, was the means to wirelessly connect the subscribers to the network. In fixed-line networks, subscriber connectivity is very simple as only two dedicated wires are necessary per user. In a GSM network, however, the subscribers are mobile and can change their location at any time. Thus, it is not possible to use the same input and output in the switching matrix for a user for each call as is the case in fixed-line networks. As a mobile network consists of many switching centers, with each covering a certain geographical area, it is not even possible to predict in advance which switching center a call should be forwarded to for a certain subscriber. This means that the software for subscriber management and routing of calls of fixed-line networks cannot be used for GSM. Instead of a static call-routing mechanism, a flexible mobility management architecture became necessary in the core network, which needed to be aware of the current location of the subscriber and was thus able to route calls to the subscriber at any time. It was also necessary to be able to flexibly change the routing of an ongoing call as a subscriber can roam freely and thus might leave the coverage area of the radio transmitter of the network over which the call was established. While there was a big difference in the software of a fixed and a Mobile Switching Center (MSC), the hardware as well as the lower layers of the software which are responsible, for example, for the handling of the switching matrix were mostly identical. Therefore, most telecommunication equipment vendors like Ericsson, Nokia Solutions and Networks, Huawei and Alcatel-Lucent offered their switching center hardware both for fixed-line and mobile networks. Only the software in the switching center decided if the hardware was used in a fixed or mobile network (see Figure 1.2) Virtual Circuit Switching over IP While in the 1990s voice calls were the dominating form of communication, this has significantly changed today with the rise of the Internet. While voice calls still remain important, other forms of communication such as , instant messaging (IM), social

20 4 From GSM to LTE-Advanced networks (e.g. Facebook), blogs, wikis and many more play an even bigger role. All these services share the Internet Protocol (IP) as a transport protocol and globally connect people via the Internet. While circuit switching establishes an exclusive channel between two parties, the Internet is based on transferring individual data packets. A link with a high bandwidth is used to transfer the packets of many users. By using the destination address contained in each packet, each network node that the packet traverses decides over which outgoing link to forward the packet. Further details can be found in Chapter 2. Owing to the rise of the Internet and IP-based applications, network operators thus had to maintain two separate networks: a circuit-switched network for voice calls and a packet-switched network for Internet-based services. As the simultaneous operation of two different networks is very inefficient and costly, most network operators have, in the meantime, replaced the switching matrix in the MSC with a device referred to as media gateway. This allows them to virtualize circuit switching and to transfer voice calls over IP packets. The physical presence of a circuit-switched infrastructure is thus no longer necessary and the network operator can concentrate on maintaining and expanding a single IP-based network. This approach has been standardized under the name Bearer-Independent Core Network (BICN). The basic operation of GSM is not changed by this virtualization. The main differences can be found in the lower protocol levels for call signaling and voice call transmission. This will be looked at in more detail in the remainder of this chapter. The trend toward IP-based communication can also be observed in the GSM radio network, even though it is still dominated today by classic circuit-switched technology. This is due to the wide distribution of the network that makes it difficult to change transport technology quickly and because the datarates required for GSM are low. The air interface between the mobile devices and the network is not affected by the transition from circuit to packet switching. For mobile devices, it is therefore completely transparent if the network uses classic or virtual circuit switching. 1.2 Standards As many telecom companies compete globally for orders of telecommunication network operators, standardization of interfaces and procedures is necessary. Without standards, which are defined by the International Telecommunication Union (ITU), it would not be possible to make phone calls internationally and network operators would be bound to the supplier they initially select for the delivery of their network components. One of the most important ITU standards discussed in Section 1.4 is the Signaling System Number 7 (SS-7), which is used for call routing. Many ITU standards, however, only represent the smallest common denominator as most countries have specified their own national extensions. In practice, this incurs a high cost for software development for each country as a different set of extensions needs to be implemented in order for a vendor to be able to sell its equipment. Furthermore, the interconnection of networks of different countries is complicated by this. GSM, for the first time, set a common standard for Europe for wireless networks, which has also been adopted by many countries outside Europe. This is the main reason why subscribers can roam in GSM networks across the world that have roaming agreements with each other. The common standard also substantially reduces research and development costs as hardware

21 Global System for Mobile Communications (GSM) 5 and software can now be sold worldwide with only minor adaptations for the local market. The European Telecommunication Standards Institute (ETSI), which is also responsible for a number of other standards, was the main body responsible for the creation of the GSM standard. The ETSI GSM standards are composed of a substantial number of standards documents, each of which is called a technical specification (TS), which describe a particular part of the system. In the following chapters, many of these specifications are referenced and can thus be used for further information about a specific topic. All standards are freely available on the Internet at [1] or at [2]. 3GPP is the organization that took over the standards maintenance and enhancement at the beginning of the UMTS standardization, as described in Chapter Transmission Speeds The smallest transmission speed unit in a classic circuit-switched telecommunication network is the digital signal level 0 (DS0) channel. It has a fixed transmission speed of 64 kbit/s. Such a channel can be used to transfer voice or data, and thus it is usually not called a speech channel but simply referred to as a user data channel. The reference unit of a telecommunication network is an E-1 connection in Europe and a T-1 connection in the United States, which use either a twisted pair or coaxial copper cable. The gross datarate is Mbit/s for an E-1 connection and Mbit/s for a T-1. An E-1 is divided into 32 timeslots of 64 kbit/s each, as shown in Figure 1.3 while a T-1 is divided into 24 timeslots of 64 kbit/s each. One of the timeslots is used for synchronization, which means that 31 timeslots for an E-1 or 23 timeslots for a T-1, respectively, can be used to transfer data. In practice, only 29 or 30 timeslots are used for user data transmission while the rest (usually one or two) are used for SS-7 signaling data (see Figure 1.3). More about SS-7 can be found in Section 1.4. A single E-1 connection with 31 DS0s is not enough to connect two switching centers with each other. An alternative is an E-3 connection over twisted pair or coaxial cables. An E-3 connection is defined at a speed of Mbit/s, which corresponds to 512 DS0s. For higher transmission speeds and for long distances, optical systems that use the synchronous transfer mode (STM) standard are used. Table 1.1 shows some datarates and the number of 64- kbit/s DS0 channels that are transmitted per pair of fibers. For virtual circuit switching over IP, optical Ethernet links are often used between network nodes at the same location. Transmission speeds of 1 Gbit/s or more are used on these links. Synchronization 31 timeslots with 8 bits (1B) each for user data or SS-7 signaling Repetition interval: 8000 Hz Speed: 32 timeslots 8 Bit /s = Mbit/s Figure 1.3 Timeslot architecture of an E-1 connection

22 6 From GSM to LTE-Advanced Table 1.1 STM transmission speeds and number of DS0s STM level Speed (Mbit/s) Approximate number of DS0 connections STM STM STM ,000 STM ,279 Unlike the circuit-switched technology described above, Ethernet is the de facto standard for IP-based communication over fiber and copper cables and is widely used. As a consequence, network equipment can be built much cheaper. 1.4 The Signaling System Number 7 For establishing, maintaining and clearing a connection, signaling information needs to be exchanged between the end user and network devices. In the fixed-line network, analog phones signal their connection request when the receiver is lifted off the hook and by dialing a phone number that is sent to the network either via pulses (pulse dialing) or via tone dialing, which is called dual tone multifrequency (DTMF) dialing. With fixed-line ISDN phones and GSM mobile phones, the signaling is done via a separate dedicated signaling channel, and information such as the destination phone number is sent as messages. If several components in the network are involved in the call establishment, for example, if originating and terminating parties are not connected to the same switching center, it is also necessary that the different nodes in the network exchange information with each other. This signaling is transparent for the user, and a protocol called the SS-7 is used for this purpose. SS-7 is also used in GSM networks and the standard has been enhanced by ETSI to fulfill the special requirements of mobile networks, for example, subscriber mobility management. The SS-7 standard defines three basic types of network nodes: Service Switching Points (SSPs) are switching centers that are more generally referred to as network elements that are able to establish, transport or forward voice and data connections. Service Control Points (SCPs) are databases and application software that can influence the establishment of a connection. In a GSM network, SCPs can be used, for example, for storing the current location of a subscriber. During call establishment to a mobile subscriber, the switching centers query the database for the current location of the subscriber to be able to forward the call. More about this procedure can be found in Section about the Home Location Register (HLR). Signaling Transfer Points (STPs) are responsible for the forwarding of signaling messages between SSPs and SCPs as not all network nodes have a dedicated link to all other nodes of the network. The principal functionality of an STP can be compared to an IP router in the Internet, which also forwards packets to different branches of the network. Unlike IP routers, however, STPs only forward signaling messages that are necessary for establishing,

23 Global System for Mobile Communications (GSM) 7 SCP SCP STP SS7 signaling channels SSP SSP SSP To the subscriber Speech channels To the subscriber Figure 1.4 An SS-7 network with an STP, two SCP databases and three switching centers maintaining and clearing a call. The calls themselves are directly carried on dedicated links between the SSPs. Figure 1.4 shows the general structure of an SS-7 circuit-switched telecommunication network and the way the nodes described above are interconnected with each other. The SS-7 protocol stack is also used in virtual circuit-switched networks for communication between the network nodes. Instead of dedicated signaling timeslots on an E-1 link, signaling messages are transported in IP packets. The following section describes the classic SS-7 protocol stack and afterward, the way SS-7 messages are transported over IP networks The Classic SS-7 Protocol Stack SS-7 comprises a number of protocols and layers. A well-known model for describing telecommunication protocols and different layers is the Open System Interconnection (OSI) 7 layer model, which is used in Figure 1.5 to show the layers on which the different SS-7 protocols reside. The Message Transfer Part 1 (MTP-1) protocol describes the physical properties of the transmission medium on layer 1 of the OSI model. Thus, this layer is also called the physical layer. Layer 7 Layer 6 Layer 5 ISUP Application MAP TCAP Application Layer 4 SCCP TCP/UDP Layer 3 MTP - 3 IP Layer 2 MTP - 2 Ethernet Layer 1 MTP - 1 Twisted pair OSI SS-7 IP Figure 1.5 Comparison of the SS-7, OSI and TCP/IP protocol stacks

24 8 From GSM to LTE-Advanced Properties that are standardized in MTP-1 are, for example, the definition of the different kinds of cables that can be used to carry the signal, signal levels and transmission speeds. On layer 2, the data link layer, messages are framed into packets and a start and stop identification at the beginning and end of each packet are inserted into the data stream so that the receiver is able to detect where a message ends and where a new message begins. Layer 3 of the OSI model, which is called the network layer, is responsible for packet routing. To enable network nodes to forward incoming packets to other nodes, each packet gets a source and destination address on this layer. This is done by the MTP-3 protocol of the SS-7 stack. For readers who are already familiar with the Transmission Control Protocol (TCP)/IP protocol stack, it may be noted at this point that the MTP-3 protocol fulfills the same tasks as the IP protocol. Instead of IP addresses, however, the MTP-3 protocol uses the so-called point codes to identify the source and the destination of a message. A number of different protocols are used on layers 4 7 depending on the application. If a message needs to be sent for the establishment or clearing of a call, the Integrated Services Digital Network User Part (ISUP) protocol is used. Figure 1.6 shows how a call is established between two parties by using ISUP messages. In the example, party A is a mobile subscriber while party B is a fixed-line subscriber. Thus, A is connected to the network via an MSC, while B is connected via a fixed-line switching center. To call B, the phone number of B is sent by A to the MSC. The MSC then analyzes the national destination code (NDC) of the phone number, which usually comprises the first two to four digits of the number, and detects that the number belongs to a subscriber in the fixed-line network. In the example shown in Figure 1.6, the MSC and the fixed-line switching center are directly connected with each other. Therefore, the call can be directly forwarded to the terminating switching center. This is quite a realistic scenario as direct connections are often used if, for example, a mobile subscriber calls a fixed-line phone in the same city. Signaling channel MSC STP Fixed-line switching center Subscriber A Speech channel Subscriber B MSC Message flow diagram IAM ACM ANM Fixed-line switching center REL RLC t Figure 1.6 Establishment of a voice call between two switching centers

25 Global System for Mobile Communications (GSM) 9 As B is a fixed-line subscriber, the next step for the MSC is to establish a voice channel to the fixed-line switching center. This is done by sending an ISUP Initial Address Message (IAM). The message contains, among other data, the phone number of B and informs the fixed-line switching center and the channel that the MSC would like to use for the voice path. In the example, the IAM message is not sent directly to the fixed-line switching center. Instead, an STP is used to forward the message. At the other end, the fixed-line switching center receives the message, analyzes the phone number and establishes a connection via its switching matrix to subscriber B. Once the connection is established via the switching matrix, the switch applies a periodic current to the line of the fixed-line subscriber so that the fixed-line phone can generate an alerting tone. To indicate to the originating subscriber that the phone number is complete and the destination party has been found, the fixed-line switch sends back an Address Complete Message (ACM). The MSC then knows that the number is complete and that the terminating party is being alerted about the incoming call. If B answers the call, the fixed-line switching center sends an Answer Message (ANM) to the MSC and conversation can start. When B ends the call, the fixed-line switching center resets the connection in the switching matrix and sends a release (REL) message to the MSC. The MSC confirms the termination of the connection by sending back a Release Complete (RLC) message. If A had terminated the call, the messages would have been identical, with only the direction of the REL and RLC reversed. For the communication between the switching centers (SSPs) and the databases (SCPs), the Signaling Connection and Control Part (SCCP) is used on layer 4. SCCP is very similar to TCP and User Datagram Protocol (UDP) in the IP world. Protocols on layer 4 of the protocol stack enable the distinction of different applications on a single system. TCP and UDP use ports to do this. If a personal computer (PC), for example, is used as both a web server and a File Transfer Protocol (FTP) server at the same time, both applications would be accessed over the network via the same IP address. However, while the web server can be reached via port 80, the FTP server waits for the incoming data on port 21. Therefore, it is quite easy for the network protocol stack to decide the application to which incoming data packets should be forwarded. In the SS-7 world, the task of forwarding incoming messages to the right application is done by SCCP. Instead of port numbers, SCCP uses Subsystem Numbers (SSNs). For database access, the Transaction Capability Application Part (TCAP) protocol has been designed as part of the SS-7 family of protocols. TCAP defines a number of different modules and messages that can be used to query all kinds of different databases in a uniform way SS-7 Protocols for GSM Apart from the fixed-line network SS-7 protocols, the following additional protocols were defined to address the special needs of a GSM network. The Mobile Application Part (MAP). This protocol has been standardized in 3GPP TS [3] and is used for the communication between an MSC and the HLR, which maintains subscriber information. The HLR is queried, for example, if the MSC wants to establish a connection to a mobile subscriber. In this case, the HLR returns the information about the

26 10 From GSM to LTE-Advanced MSC to HLR MSC to MSC MSC to BSS MSC to mobile station Layer 7 Layer 6 Layer 5 Layer 4 Layer 3 Layer 2 Layer 1 OSI MAP DTAP TCAP BSSMAP SCCP SCCP MTP - 3 MTP - 2 MTP - 1 SS-7 BSSAP Figure 1.7 Enhancement of the SS-7 protocol stack for GSM current location of the subscriber. The MSC is then able to forward the call to the mobile subscriber s switching center establishing a voice channel between itself and the next hop by using the ISUP message flow that has been shown in Figure 1.6. MAP is also used between two MSCs if the subscriber moves into the coverage area of a different MSC while a call is ongoing. As shown in Figure 1.7, the MAP protocol uses the TCAP, SCCP and MTP protocols on lower layers. The Base Station Subsystem Mobile Application Part (BSSMAP). This protocol is used for communication between the MSC and the radio network. Here, the additional protocol is necessary, for example to establish a dedicated radio channel for a new connection to a mobile subscriber. As BSSMAP is not a database query language like the MAP protocol, it is based on SCCP directly instead of using TCAP in between. The Direct Transfer Application Part (DTAP). This protocol is used between the user s mobile device, which is also called mobile station (MS), and the MSC to communicate transparently. To establish a voice call, the MS sends a setup message to the MSC. As in the example in Section 1.4.1, this message contains among other things the phone number of the called subscriber. As it is only the MSC s task to forward calls, all network nodes between the MS and the MSC forward the message transparently and thus need not understand the DTAP protocol IP-Based SS-7 Protocol Stack When using an IP network for the transmission of SS-7 signaling messages, the MTP-1 and MTP-2 protocols are replaced by the IP and the transport medium-dependent lower layer protocols (e.g. Ethernet). Figure 1.8 shows the difference between the IP and the classic stack presented in the previous section. In the IP stack, layer-4 protocols are either UDP or TCP for most services. For the transmission of SS-7 messages, however, a new protocol has been specified, which is referred to as Stream Control Transmission Protocol (SCTP). When compared to TCP and UDP, it offers advantages when many signaling connections between two network nodes are active at the same time.

27 Global System for Mobile Communications (GSM) 11 MSC to HLR and MSC to MSC MSC to HLR and MSC to MSC Core network Call control MSC to BSS and MSC to mobile Core network Call control MSC to BSS and MSC to mobile ISUP MAP DTAP TCAP BSSMAP SCCP SCCP MTP - 3 MTP - 2 MTP - 1 SS-7 over MTP BICC MAP TCAP SCCP IP, SCTP, M3UA Ethernet and others SS-7 over IP (SIGTRAN) DTAP BSSMAP SCCP Figure 1.8 Comparison of the classic and IP-based SS-7 protocol stacks On the next protocol layer, SCTP is followed by the M3UA (MTP-3 User Adaptation Layer) protocol. As the name implies, the protocol is used to transfer information that is contained in the classic MTP-3 protocol. For higher protocol layers such as SCCP, M3UA simulates all functionalities of MTP-3. As a consequence, the use of an IP protocol stack is transparent to all higher layer SS-7 protocols. In the industry, the IP-based SS-7 protocol stack or the IP-based transmission of SS-7 messages is often referred to as SIGTRAN (signaling transmission). The abbreviation originated from the name of the IETF (Internet Engineering Task Force) working group that was created for the definition of these protocols. As described in Section 1.1.1, the ISUP protocol is used for the establishment of voice calls between switching centers and the assignment of a 64 kbit/s timeslot. In an IP-based network, voice calls are transmitted in IP packets. As a consequence, the ISUP protocol has to be adapted as well. The resulting protocol is referred to as Bearer-Independent Call Control (BICC) protocol, which largely resembles ISUP. As IP links cannot be introduced on all interfaces in live networks at once, Signaling Gateways (SGWs) have been defined to bridge E-1 based and IP-based SS-7 communication. The SGWs adapt the lower layers of the protocol stack and thus make the differences transparent for both sides. This is necessary, for example, if the subscriber database has already been converted for IP interfaces while other components such as the switching centers are still using traditional signaling links. To bridge voice calls between E-1 based and IP-based networks, Media Gateways (MGWs) are used. Connected to an MSC Server, an MGW handles both IP-based and E-1-based voice calls transparently as it implements both the classic and IP-based signaling protocol stacks. 1.5 The GSM Subsystems A GSM network is split into three subsystems which are described in more detail below: The Base Station Subsystem (BSS), which is also called radio network, contains all nodes and functionalities that are necessary to wirelessly connect mobile subscribers over the

28 12 From GSM to LTE-Advanced radio interface to the network. The radio interface is usually also referred to as the air interface. The Network Subsystem (NSS), which is also called core network, contains all nodes and functionalities that are necessary for switching of calls, for subscriber management and mobility management. The Intelligent Network Subsystem (IN) comprises SCP databases that add optional functionality to the network. One of the most important optional IN functionalities of a mobile network is the prepaid service, which allows subscribers to first fund an account with a certain amount of money which can then be used for network services like phone calls, Short Messaging Service (SMS) messages and, of course, data services via GPRS and UMTS as described in Chapters 2 and 3. When a prepaid subscriber uses a service of the network, the responsible IN node is contacted and the amount the network operator charges for a service is deducted from the account in real time. 1.6 The Network Subsystem The most important responsibilities of the NSS are call establishment, call control and routing of calls between different fixed and mobile switching centers and other networks. Other networks are, for example, the national fixed-line network, which is also called the Public Switched Telephone Network (PSTN), international fixed-line networks, other national and international mobile networks and Voice over Internet Protocol (VoIP) networks. Furthermore, the NSS is responsible for subscriber management. The nodes necessary for these tasks in a classic network architecture are shown in Figure 1.9. Figure 1.10 shows the nodes required in IP-based core networks. Both designs are further described in the following sections The Mobile Switching Center (MSC), Server and Gateway The MSC is the central element of a mobile telecommunication network, which is also called a Public Land Mobile Network (PLMN) in the standards. In a classic circuit-switched network, BSS BSS PSTN E-interface G-MSC VLR MSC VLR A-interface C-interface D-interface HLR Figure 1.9 Interfaces and nodes in a classic NSS architecture

29 Global System for Mobile Communications (GSM) 13 BSS BSS A-Interface PSTN Nb MGW Mc MGW MSC-S Nc MSC-S S-GW VLR VLR C and D-Interface HLR Figure 1.10 Interfaces and nodes in an IP-based NSS architecture all connections between subscribers are managed by the MSC and are always routed over the switching matrix even if two subscribers that have established a connection communicate over the same radio cell. The management activities to establish and maintain a connection are part of the Call Control (CC) Protocol, which is generally responsible for the following tasks: Registration of mobile subscribers: When the mobile device, also referred to as MS, is switched on, it registers to the network and is then reachable by all other subscribers of the network. Call establishment and call routing between two subscribers. Forwarding of SMS messages. As subscribers can roam freely in the network, the MSC is also responsible for the Mobility Management (MM) of subscribers. This activity comprises the following tasks: Authentication of subscribers at connection establishment is necessary because a subscriber cannot be identified as in the fixed network by the pair of copper cables over which the signal arrives. Authentication of subscribers and the authentication center (AuC) are further discussed in Section If no active connection exists between the network and the mobile device, the MSC has to report a change of location to the network to be reachable for incoming calls and SMS messages. This procedure is called location update and is further described in Section If the subscriber changes its location while a connection is established with the network, the MSC is part of the process that ensures that the connection is not interrupted and is rerouted to the next cell. This procedure is called handover and is described in more detail in Section